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Detailed Action 

Response to Arguments 

1 . Applicant's arguments with respect to claims 1 -29 have been considered but they 
are moot in view of the new ground(s) of rejection. 

2. Applicant argues that the event graph of Mishra is not an event relationship 
network that can be used to construct one or more correlation rules for use by a 
correlation engine in an event management system. 

The Office respectively disagrees. 

Mishra teaches the rule creation, in Page 57, the algorithm compile-event, if the 
rule has a contingency plan, the algorithm first defines trees corresponding to 
rule event, then modify action part of the original rule, after that it creates Rule-b. 
From the algorithm, it teaches the tree construction (the event relation graph, 
see page 58, first paragraph), and from the tree, it creates Rule-b. That proves 
the algorithm can generate rules from the tree. 



Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 
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1 . Claims 1 ,3 and 1 6 are rejected under 35 USC 1 03(a) as being unpatentable 
over Mishra D., (SNOOP: An Event Specification Language for Active Database 
System, Thesis from U. of Florida, 1991) in view of Yoshida (US Patent 6006213). 

2. Regarding claim 1, Mishra teaches a computer-based method (Mishra, P. 57, 1. 1- 

3. event compiler with the algorithm) for use in accordance with an event management 
system, the method comprising the steps of: 

• automatically generating one or more event relationship network 
from event data, wherein an event relationship network comprises a 
graphical representation wherein nodes representing events and 
links connecting correlated nodes (Mishra, Pg.57 t 1. 2-3, 6, Pg.58, 

1. 2-8, compiler converts the event expression in the input and 
building the graph, the event graph comprises the nodes represent 
composite events and link represent the path send to the nodes); 
and 

Mishra discloses the automatically generating the event relationship 
network from event data, he fails to mention the utilization of the event graph to 
construct the correction rules. 

However, Yoshida teaches: 

• utilizing the one or more generated event relationship networks to 
construct one or more correlation rules for use by a correlation 
engine in the event management system (Yoshida, col.2, 1.45-49, in 
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which the extract patterns corresponds to the event graph, and the 
conversion into rules for high speed operation (correlation engine)). 
It would have been obvious to one ordinary skilled in the art at the time the 

invention was made to include the teaching of Yoshida for correlation rule used by the 

correlation engine. 

The motivation would be for Mishra to combine with Yoshida is to achieve 
the extracting a set of patterns frequently appearing in the graph, evaluating the 
extracted pattern based on the resulting graph size reduction, and outputting a pattern 
having a good evaluation result (Yoshida, col.1, 1.60-65). 

3. Claims 2,and 15 are rejected under 35 USC 103(a) as being unpatentable over 
Mishra D., in view of Yoshida and further in view of Babson et al., (US Patent No. 
5345380). 

Mishra, and Yoshida teach the event graph generation automatically, and utilize 
the correlation rule for the correlation engine, but lack of the teaching of human review 
prior to utilize the event graph. 

However, regarding 2, Babson teaches further discloses the method of claim 1 , 
further comprising the step of subjecting the one or more generated event relationship 
networks to human review prior to utilizing the one or more generated event relationship 
networks to construct the one or more correlation rules (Babson, col.2, 1. 64-67, col. 3, 
1.1-10, in which the presenting the customer with a plurality of type of nodes, receiving 
from the customer indication of desired relationships between the desired nodes ). 

It would have been obvious to one ordinary skilled in the art at the time the 
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invention was made to include the teaching of Babson for human review prior to 
correlation engine. 

The motivation would £)e for combining Mishra, and Yoshida to present the event 
graph to human review to receive from the customer values for parameters to be used 
with the desired nodes; and construction of a graphical representation of the desired 
nodes; and to provide the desired service. (Babson, Abstract, col. 3 ,1.5-9) 
4. Regarding claim 3, Mishra further discloses the method of claim 1 , wherein, 

when one or more previously generated event relationship networks are 

available, the step of automatically generating one or more event 

relationship networks comprises: 

• obtaining one or more previously generated event relationship 
networks (Mishra, Pg. 57, 1. 10, read rule-definition corresponds to 
the obtaining the previous event graph); 

• validating the one or more previously generated event relationship 
networks by removing any nodes or links included therein that are 
incorrect for a particular application context (Mishra, Pg. 57, 1.12, 
define corresponds to the rule eventl and rule-event2, and modify 
part of the original rule); 

• completing the one or more previously generated event relationship 
networks by adding any nodes or links thereto that are missing for 
the particular application context (Mishra, Pg. 57, 1.18, build-tree 
corresponds to the completing the event graph); 
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• outputting the one or more validated and completed event 
relationship networks as the one or more event relationship 
networks used to construct the one or more correlation rules 
(Mishra, Pg. 57, 1.1 4,& I.20, in which the create rule and merge it in 
the event forest corresponds to the outputting and completed event 
graph). 

5. Claims 4-7, 11,13, 17-20, 24, and 26 are rejected under 35 U.S.C 103(a) as 
being unpatentable over Mishra in view of Yoshida, and further in view of Yemini et al., 
(US Patent 6249755). 

6. Regarding claims 4, Mishra, and Yoshida differ from the claimed invention in that 
Mishra does not disclose the statistical correlation analysis. However, Yemini further 
discloses the method of claim 3, wherein the validating and completing steps utilize a 
statistical correlation analysis (Yemini, col. 13, 1.10-20). 

It would have been obvious to one ordinary skilled in the art at the time the 
invention was made to include the teaching of Yemini for event correlation analysis by 
using graphic model (Yemini, col. 17, 1. 40-50 col. 24, 1. 29-37). 

The motivation would be for combining Mishra and Yemini is to execute 
computer code efficiently determining problem events from observable symptoms. 
(Yemini, Abstract, col. 7, 1. 64-67) 

7. Regarding claim 5, Yemini further discloses the method of claim 4, wherein the 
statistical correlation analysis utilizes pairwise correlation analysis, wherein 
correlation between a pair of events is measured in accordance with one or more 
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statistical measurements (Yemini, col. 17, 1. 59-65). 

8. Regarding claim 6, Yemini further discloses the method of claim 3, 
wherein the validating step comprises, for a particular event relationship 
network, determining that links in the event relationship network have a 
confidence level not less than a given threshold (Yemini, col. 25, 1.9-1 1 ). 

9. Regarding claim 7, Yemini further discloses the method of claim 3, 
wherein the validating step, for a particular event relationship network, 
comprises: 

• splitting the event relationship network into correlation paths 
(Yemini, col. 19, 1. 23-33, in which the classifies corresponds 
to split); 

• for every correlation path, removing a node that has the 
least number of correlated nodes associated therewith until 
every node is fully correlated with every other node 
(Yemini, col.25, 1.9-13); and 

• merging correlation paths into one or more event relationship 
networks such that every path in a resulting event 
relationship network has every node fully correlated with 
every other node in the path (Yemini, col. 17, 1. 59-65). 

1 0. Regarding claim 1 1 , Yemini further discloses the method of claim 1 , 
wherein the event data is obtained from an event log representing 
historical events associated with a particular system being managed by the 
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event management system (Yemini, col.11, 1. 32-36, col. 24, L57-67, col. 25, 
1.1-8). 

1 1 . Regarding claim 13, Yemini further discloses the method of claim 1 , 
wherein the event data is preprocessed prior to use in generating the one 
or more event relationship networks by removing at least a portion of any 
redundant events (Yemini, col. 8, 1.7-10). 

12. Claims 8-10,12, 21-23 and 25 are rejected under 35 U.S.C 103(a) as being 
unpatentable over Mishra in view of Yoshida, in view of Yemini et al., and further in 
view of Bettini et al., (Title: Testing complex temporal relationship involving multiple 
granularities and its application to data mining, 1996 ACM ). 

As mentioned above, Mishra, Yoshida, and Yemini disclose the limitations of 
event relationship network, but fail to teach the mining pattern. 

13. However, regarding claim 8, Bettini further discloses the method of claim 1 , 
wherein, when one or more previously generated event relationship networks are not 
available, the step of automatically generating one or more event relationship networks 
comprises: 

• mining patterns from the event data (Bettini, page 74, 1.32-50, in 
which the mining process (mining pattern) derived from event 
structure (event data) is effective ); 

• utilizing the mined patterns to construct the one or more event 
relationship networks (Bettini, page73, figure 2)); 
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• outputting the one or more event relationship networks constructed 
from the mined patterns as the one or more event relationship 
networks used to construct the one or more correlation rules 
(Bettini, page 74, 1. 3-5, step 2 gives a general rule to reduce the 
length of the input event..). 
It would have been obvious to one ordinary skilled in the art at the time the 
invention was made to include the teaching of Bettini for obtaining data mining structure. 

The motivation would be for combining Mishra, Yoshida, Yemini and Bettini is to 
process data mining in the procedure and find the temporal patterns, i.e. instantiations 
of the variables in the structure. 

14. Regarding claim 9, Bettini further discloses the method of claim 8, 
wherein the constructing step utilizes a statistical correlation analysis to 
mine patterns (Bettini, page 71, theorem 1, 1. 30-32 the event X0 occurrence 
between month in a year is a statistical correlation analysis ). 

15. Regarding claim 10, Bettini further discloses the method of claim 8, 
wherein the statistical correlation analysis utilizes pairwise correlation 
analysis, wherein correlation between a pair of events is measured in 
accordance with one or more statistical measurements (Bettini, figure 1). 

1 6. Regarding claim 1 2, Bettini further discloses the method of claim 1 , 
wherein the one or more event relationship networks comprise annotations 
relating to statistical correlation between nodes (Bettini, page 71, figure 1,the 
annotation on the link between nodes related to statistical correlation). 
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17. Regarding claims 14, 16, 27 have similar limitations as claim 1. Therefore, claims 
14,16, 27 are rejected for the same reasons set forth in the rejection of claims 1 . 

18. Regarding claim 15 has similar limitations as claim 2. Therefore, claim 15 
is rejected for the same reasons set forth in the rejection of claim. 

19. Regarding claims 17-20, 24, and 26 have similar limitations as claims 4-7, 1 1 t and 
13. Therefore, claims 17-20, 24, and 26 are rejected for the same reasons set 
forth in the rejection of claims 4-7, 1 1 and 13. 

20. Regarding claims 21-23, and 25 have similar limitations as claims 8-10, and 12. 
Therefore, claims 21-23, and 25 are rejected for the same reasons set forth in 
the rejection of claims 8-10, and 12. 

21 . Claims 28, and 29 are rejected under 35 USC 1 03(a) as being unpatentable 
over Mishra D., in view of Tenev (US Patent 6108698). 

Mishra discloses the automatically generating the event relationship 
network from event data, Mishra does not specifically disclose to compute a first 
correlation metric and second correlation metric. 

However, Regarding claim 28, Tenev further discloses the method of claim 
1 , further wherein automated generation of at least one of the one or more event 
relationship networks comprises use of an automated pairwise statistical 
correlation procedure which is configured to compute a first correlation metric 
and a second correlation metric, the second correlation metric being 
representative of a correlation between events that is stronger than a correlation 
between events represented by the first correlation metric (Tenev, col.9, L32-45). 
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Because knowing that the directed graph data structure is relevant to the 
rules performed by the grapher, it would have been obvious to use the directed 
graph data structure in the Mishra's algorithm. Therefore, the claimed invention 
would have been obvious to one of ordinary skill in the art at the time of the 
invention. 

22. Regarding claim 29, Tenev further discloses the method of claim 1 , further 
wherein automated generation of at least one of the one or more event 
relationship networks comprises specifying an event data window within which 
event data is considered (Tenev, col. 13, I.28-39). 

Conclusion 

Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action, Accordingly, THIS ACTION IS MADE FINAL. See MEPE 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first replay is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE MONTH shortened statutory period, then the 
shortened statutory period will expire on the date advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTH from the date of this final action. 
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Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Kelvin Lin whose telephone number is 571-272-3898. 
The examiner can normally be reached on Flexible 4/9/5. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Andrew Caldwell can be reached on 571-272-3868. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 



5/21/06 
KYL 




;W CALDWELL 

^ ^5/;^ EXTENT EXAMINER 



